REA 逆向分析工作流

Android application artifacts#

Use the connected server's advertised Android tools. Repository main and npm 4.1.0 include this family. A skill installation alone cannot add it to an older server.

Start with inspect_android_package on the caller's APK path for package identity, manifest declarations, coverage, and inline Evidence. Use search_android_classes to find candidates, inspect_android_class for one class's members, inspect_android_method for decompilation, and trace_android_references for incoming static references. Each call takes its own APK path and explicit selectors; do not open a native session first. Choose an overload_index from the class inventory when methods are ambiguous instead of guessing.

The provider requires a separately supplied headless JADX MCP JAR 0.7.1 and Java 17 or newer. REA_JADX_MCP_JAR selects the absolute JAR path; JAVA_HOME can select Java. REA setup does not install or configure that JAR, and doctor provider scopes cover Hopper/Ghidra rather than JADX. Use existing tools and report missing prerequisites for the Android task specifically.

Linux and macOS use the POSIX owned-process boundary. Windows x64 requires the matching bundled native controls and uses an owned Job Object with bidirectional stdio. A full JDK, including jdk.compiler, is required on every host; Windows JAVA_HOME selects bin\java.exe. Consult the Android guide for actual host verification coverage. Calls use one worker and provider deadlines; optional REA_JADX_HEAP_MIB selects the JVM heap and REA_JADX_OPERATION_TIMEOUT_MS the per-operation deadline (default 120000 ms; the MCP client's tool timeout must also allow it). The APK is never launched, and no emulator is required.

Manifest entries and decompiled text are static observations, not execution or policy enforcement. Incoming references are recovered static relationships; reflection, dynamic loading, and unresolved calls remain unknown. Preserve artifact digests, locations, diagnostics, and incomplete coverage. For archive members rather than code analysis, use open_binary and inspect_artifact.